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Abstract — In this paper, we consider the problem of secret 
key agreement in state-dependent 3-receiver broadcast channels. 
In the proposed model, there are two legitimate receivers, an 
eavesdropper and a transmitter where the channel state infor- 
mation is non-causally available at the transmitter. We consider 
two setups. In the first setup, the transmitter tries to agree on 
a common key with the legitimate receivers while keeping it 
concealed from the eavesdropper. Simultaneously, the transmitter 
agrees on a private key with each of the legitimate receivers that 
needs to be kept secret from the other legitimate receiver and the 
eavesdropper. For this setup, we derive inner and outer bounds 
on the secret key capacity region. In the second setup, we assume 
that a backward public channel is available between the receivers 
and the transmitter. Each legitimate receiver wishes to share a 
private key with the transmitter. For this setup, an outer bound 
on the secret key-private capacity is found when the channel state 
information is non-causally available at the transmitter and is 
shown to coincide with an inner bound for some special cases. 
Furthermore, the capacity region of the secret key in the state- 
dependent wiretap channel can be deduced from our inner and 
outer bounds. 

I. Introduction 

Secret key sharing is attended in different contexts. Confi- 
dential communication, sending private messages and secure 
dividing between users in a network are some of the problems 
that dealing with secret key agreement as a bottleneck. In 
particular, its potential makes a lot of motivations on wireless 
networking community. In 1949, Shannon introduced a perfect 
security condition in a system with an eavesdropper. He 
offered that, for perfect secrecy, the key's randomness must 
be grater than the message's randomness [1], He utilized the 
entropy function to measure the randomness [2]. For key 
agreement over a network, we need the common random- 
ness between legitimate users. Common randomness can be 
achieved through correlated sources or channel distribution, 
which categorizes secret key agreement into two different 
models, Source model and Channel model. The problem of 
secret key agreement in the source model was first studied 
by Ahlswede and Csiszar [3]. They considered a network 
with two legitimate users and an eavesdropper. The legitimate 
users are connected with an insecure noiseless channel while 
observing correlated sources. The legitimate users intend to 
agree on a secret key for secure communication. In the channel 
model, using noisy channel may not have sufficient common 
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randomness itself. Maurer used a backward public channel to 
provide enough common randomness between the legitimate 
users [4]. In this model, public discussion is used in the wiretap 
channel. In [5], Gohari and Anantharam studied a multiple 
terminals channel model where legitimate terminals and an 
eavesdropper are all connected by a M-receiver broadcast 
channel and an interactive public channel. Only a set of 
legitimate terminals have the ability to transmit messages over 
the public channel. Upon receiving noisy messages from the 
M-receiver broadcast channel and insecure messages from the 
public channel, the legitimate terminals agree on a common 
key. Instead of using the public channel, correlated sources can 
be utilized in the channel model. The correlation between the 
sources acts as common randomness and helps the legitimate 
users to agree on secret keys. Khisti el. al., established this 
idea in a 2-receiver broadcast channel with an eavesdropper 
[6]. In this model, the transmitter and the legitimate receiver 
have access to correlated sources and agree on a private 
key. Salimi and Skoglund, developed the channel model with 
correlated sources in a generalized multiple access channel 
where each of transmitters intends to agree on an independent 
private key with a receiver [7]. Assumption of channel state 
information accessibility is more practical than the correlated 
sources existence in the channel model. In such networks, 
the channel state information can be considered as common 
randomness for secret key generation. In [8]-[10], the problem 
of secret key sharing is investigated over the wiretap channel 
with non-causal and causal channel state information. 

In each network, there are different classes of users. Con- 
sider a network with four types of users, Trusted Center (TC), 
Cluster Node (CN), End Node (EN) and illegal user, which 
have different levels of accessibility. This network can be 
divided into sub-networks. Each sub-network contains one 
CN and some ENs. The CNs manage sub-networks while the 
whole network is controlled by the TC. The TC broadcasts 
data signals to all users, however, control signals are only 
transmitted for CNs. In such networks, control signals must 
be kept secret from the ENs. In addition, the illegal users 
try to eavesdrop on both data and control signals. Motivated 
by the above scenario, we study the problem of secret key 
sharing in state-dependent 3-receiver broadcast channels where 
Channel State Information (CSI) is non-causally available at 
the transmitter. We consider four users which are two CNs, a 
TC and an illegal user. Without loss of generality ENs are not 



considered. Two different models are discussed: 

• No Public Discussion: Here, the transmitter intends to 
agree on a common key with the legitimate receivers and 
a private key with the corresponding receivers. 

• With Public Discussion: An insecure public channel is 
available between the receivers and the transmitter. Each 
legitimate receiver wishes to agree on a private key with 
the transmitter. 

In the first model, an inner bound to the secret key capacity 
region is derived when joint source channel coding scheme 
is used. The coding scheme combines the aspects of both 
source and channel coding for secret key generation. Also, 
an outer bound to the secret key capacity region is obtained. 
In the second model, we establish an inner bound on the 
secret key capacity region where the double random binning is 
employed. An explicit outer bound on the secret key capacity 
region is found and for some special cases, the secret key 
capacity region is established. Furthermore, it is shown that 
the capacity region of the secret key in the state-dependent 
2-receiver broadcast channel with an eavesdropper can be 
deduced from our inner and outer bounds. 

The rest of the paper is organized as follows. In Section 
II, the system model is described. In Section III, our main 
results and the intuitions behind them are given. In Section 
IV, proofs of the Theorems are presented. Finally, conclusions 
are provided in Section V. 

II. Problem Definition 

Throughout the paper, we denote a discrete random variable 
with an upper case letter (e.g., X) and its realization by 
the lower case letter (e.g., x). We denote the probability 
density function of X over X with px(x) and the conditional 
probability density function of Y given X by p Y \x{v\ x )- 
Finally, we use Y n to indicate vector (Yl, Y2, . . . ,Y n ). 

In order to investigate the problem of secret key agree- 
ment over state-dependent 3-receiver broadcast channels, we 
consider a channel model consisting of a transmitter, two 
legitimate receivers and an eavesdropper. The transmitter 
communicates with the other three users over a 3-receiver 
broadcast channel. We assume that the channel is discrete 
memoryless with an input alphabet X, output alphabets y\,y 2 
and Z depending on a parameter S with values in a set S. 

In the described model, we consider two cases separately; 
A. no public discussion is allowed between the transmitter 
and the receivers. B. public discussion is allowed between the 
users. 

A. The Model Without Public Discussion 

In the model without public discussion, as Fig. 1 illus- 
trates, the CSI is available at the transmitter. The trans- 
mitter needs to generate three random variables Uq , U\ 
and U 2 according to the conditional probability distribution 

Pu ,u 1 ,u 2 \s(uo,ui,u2\s), which cover S. First, the transmitter 
generates 
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Fig. 1. The state-dependent 3-reveiver broadcast channel without public 
discussion 



as a common key for sharing with the legitimate receivers, 
also, computes two independent keys 

fe 1 = / 1 «,< )S "),A;iG[l:2™^) (2) 
fc2 = /a(u5 s «5,« n ),fcae [1:2"*°) (3) 

as private keys for sharing with the first and second legitimate 
receivers, respectively. After that, the transmitter determines 
the channel input xi to the channel as a deterministic function 
such that Xi = Xi(uoi,uu,u 2 i, Si) for i £ [1 : n]. Conse- 
quently, the outputs yu>V2i ar >d z% are observed by the 
receivers. The legitimate receivers intend to estimate the keys 
according to deterministic functions as follows: 
the first legitimate receiver: 



fcoi = 001(2/1,0 

the second legitimate receiver: 

km = 502(2/2,0 



fci=.9i(y5>o,<) (4) 



k 2 = ff2(s/2>"0,«2 



(5) 



Definition 1: A rate triple (Rq,Ri,R 2 ) is said to be 
achievable if for every e > and sufficiently large n, there 
exists a protocol such that 



Pr{U 4 2 =1 {^o ^ K 0i }} < e 

Vx{Kx ^ £ x } < e , Vt{K 2 ± K 2 } < e 

-I(Ki;Z n ) < e for £ = 0,1,2 



I(K i; K ,K 2 ,Y 2 n ) <e 



n 
1 

n 

-I(K 2 ;K ,K U Y?) <e 
n 

ilog|#i|< -H(Ki) + e 
n n 

-H(Ki) >R l -e 
n 



for £ = 0,1,2 
for £ = 0,1,2 



(6) 
(7) 

(8) 
(9) 
(10) 

(11) 
(12) 



Equations d6]) and (j7]i are the reliability conditions of the keys. 
Equation ([8F shows that the eavesdropper can not reconstruct 
the keys. Equations |9]l and ( fT0| ) mean that each legitimate re- 
ceiver has efficiently no information about the other legitimate 



fco = /oK,s"),fc e [1:2"*°) 



(1) 



receiver's private key. Finally, set of equations (111 and (12i 
investigate uniformity conditions. 



Definition 2: The key capacity region is the set of all 
achievable rate triples (Rq, R\, R 2 ). 

In the next sub-section, we define the problem of secret key 
agreement in state-dependent 3-receiver broadcast channels 
when a public discussion is allowed between the transmitter 
and the receivers. 

B. The Model With Public Discussion 

In the model with public discussion, as Fig. 2 illustrates, 
the CSI is also known non-causally at the transmitter and a 
public channel is available from the receivers to the transmitter. 
This model has some differences with the model discussed 
in sub-section II. A. In the current model, the legitimate 
receivers generate secret keys and use the public channel to 
transmit the required information to the transmitter for the key 
reconstruction. However, in the model without public channel, 
the transmitter generates the secret keys and transmits the 
required information via the 3-receiver broadcast channel to 
the legitimate receivers. The transmitter sends the ith channel 
input as a function of CSI, i(s n ). After receiving 

Ui and y 2 , tne fi rst an( l second legitimate receivers compute 
private keys 

fci = /i(l/?), fciG[l:2" fll ) (13) 
fe = / a (y?), k 2 e [l:2 nR °) (14) 

respectively. After that, the legitimate receivers transmit ipi 
and ip2 over the public channel as deterministic functions of 
their observations from the channel ipi and ip 2 . The transmitter 
computes k\ and k 2 as tne estimation of keys k\ and k 2 such 
that 



fci =gi(x n ,s n ,ip 1 ) 



k 2 = g 2 (x n ,s n ,^ 2 ). (15) 



Definition 3: A rate pair (iZj, R 2 ) is said to be achievable if 
for every e > and sufficiently large n, there exists a protocol 
such that 



i(Jf a ;Jfi,i?,Vi,V^)<e 



Pr{J^ ? K{\ < e , Pr{K 2 ^ K 2 } < e 

-I{K 1 ;K 2l Y 2 n ^ 1 ^ 2 )<e 
n 
1 

n 

-I{Ki-Z n ,M 2 )<e 
n 

ilog|^|< -H{Ki)- 
n n 

-H{Ki) >R l -e 



for i = 1,2 
for i= 1,2 
for i = 1,2 



(16) 
(17) 

(18) 

(19) 

(20) 

(21) 



Equation ( [To} is the reliability conditions of the private keys. 
Equations ( 17 1, ( 18 1 and ( 19 1 mean that the eavesdropper and 



each legitimate receiver have efficiently no information about 
the other legitimate receiver's private key. Finally, the set of 
equations ( pO} and pT| ) investigate uniformity conditions. 

Definition 4: The private key capacity region is the set of 
all achievable rate pairs (Ri,R 2 ). 
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Fig. 2. The state-dependent 3-receiver broadcast channel with presence of 
public discussion 



III. Main Results 

In this section, we state the main results about the described 
models. We discuss the cases of no public discussion in sub- 
section III. A and with public discussion in sub-section III.B. 

A. The Model Without Public Discussion 

For the model without public discussion, we establish the 
following inner and outer bounds on the secret key capacity 
region. 

Theorem 1 (Inner Bound): The rate triple {Rq, R\, R 2 ) is 
achievable for the model without public discussion if: 

;Y 1 ),I(U Q ;Y 2 )}-I(U ;Z)} + 
■^po) - I{Ur,Y 2 ,U 2 \U ), 
■Y 1 \U )~I(U 1 - 1 Z\U a )}] + 
\Yt\U q ) - IiU^YuU^Ua), 
;Y 2 \Uo)-I(U 2 ;Z\U )}} + 



(22) 



R Q < [min{/([/ 
Rl < [min{/([/i 

R 2 < [min{I(U 2 
I(U 2 

subject to the constraints: 

HUoM) >I(U ;S) 

I(U ;Y 2 )>I(U Q ;S) 
W^Uo) >I(Ui;S\U Q ) 
I(U 2 ;Y 2 \Uo)>I{U 2 ;S\U ) (23) 

for some input distributions: 

Ps,£/ D ,i7i,t/2,x,ri,r 2 ,z(s, "o, uuu 2 ,x, 2/1,2/2, 2) = 

Ps(s)Pu \s(M s )PU 1 \S,U ("1 l s > «o)Pc/ 2 |S,!7o ( u 2 \s, U ) 
PX\S,U ,U lt U 2 {x\s, Uq, U 1 ,U 2 )p Yl ,Y 2 ,Z\X,s(yi,y2, z\x, s) 

Proof: See Section IV. A. 

Where the function [x] + equals to x if x > and if x < 0. 
For the achievability, we use a scheme which utilizes joint 
source channel coding for two discrete memoryless sources 
over the broadcast channel and also, the random binning to 
satisfy secrecy constrains. 

Theorem 2 ( Outer Bound): For the model without public 
discussion, any rate triple (Rq, R 1: R 2 ) must satisfy 

Rq < mm{I(X, S; Y 1 \Z), I(X, S; Y 2 \Z)} 
R 1 < mm{I(X, S; Y 1 \Y 2 ), I(X, S; Y 1 \Z)} 



R 2 <mm{I(X,S;Y 2 \Y 1 ),I(X,S;Y 2 \Z)} (24) 

for some input distributions Ps,x,Yi,y 2 ,z- 
Proof: See Section IV. B. 

Remark 1: By setting Ui = U 2 = in Theorem 1 and Y\ = 
Y 2 in Theorem 1 and Theorem 2, the region reduces to the 
region of the secret key in the wiretap channel with no public 
discussion which was investigated in [8] by Khisti et. al. 

B. The Model With Public Discussion 

For the model with public discussion, we establish the 
following inner and outer bounds on the private key capacity 
region. 

Theorem 3 (Inner Bound): The rate pair (R\,R 2 ) is 
achievable for the model with public discussion if: 

Ri < [min^X.S;^)-/^;^), 

7(X,S;Y 1 )-7(Y 1 ;Z)}]+ 
R 2 < [min{7(X, S; Y 2 ) - 7(Y i; Y 2 ), 

I(X,S;Y 2 )-I(Y 2 ;Z)}]+ (25) 
for some input distributions: 

Ps,x,Y 1 ,Y 2 ,z(s,x,y 1 ,y 2 ,z) = Ps{s)p x \s{x\s) 

PY 1 ,Y 2 ,Z\X,s{yi,V2,z\x,s). 

Proof: See Section IV. C. 

The main idea for achieving the inner bound comes from 
the Slepian and Wolf coding scheme for distributed lossless 
source coding problems [11]. In addition, we use the double 
random binning to satisfy the secrecy constrains. 

Remark 2: By setting Y\ = Y 2 in Theorem 3, the inner 
bound reduces to the inner bound on the secret key in the 
wiretap channel with public discussion which was studied in 
[9] by Khisti et. al. 

Theorem 4 ( Outer Bound): For the model with public dis- 
cussion, any rate pair (Ri,R 2 ) must satisfy 

Ri < mm{I(X, S; Y X \Y 2 ),I{X, S: Y X \Z)} 
R 2 <mm{I(X,S;Y 2 \Y 1 ),I(X,S;Y 2 \Z)} (26) 

for some input distributions ps,x.y x ,y 2 .z- 

Proof: The proof follows similar to Theorem 1 in [3]. 

In the following, we obtain the private key capacity region 
for some special cases. 

Corollary 1: If the input and outputs of a state-dependent 
3-receiver broadcast channel form a Markov chain as 
Yi— >-(X, S)^fZ^fY 2 , i.e., Y 2 and Z are degraded versions of 
Y\. The private key capacity region reduces to: 

R 1 =I(X,S;Y 1 \Z) , R 2 = (27) 

Proof: The achievability follows from Theorem 3 where we 
have: 

R 1 > I{X, S;Yi)- ma X {7(y 1 ; Y 2 ), I(Y U Z)} 

( => I{X,S-Y l )-I(Y 1 -Z) 

= I(X, S, Z;Yx)- I(Z; Y^X, S) - 7(Y i; Z) 

( = } 7(Y i; Z) + I{X, S; Yx\Z)- I{Y X -Z) = I(X, S; Y X \Z) 



(a) and (b) can be deduced from the Markov chain Yj — > 
(X, S) — > Z — > Y 2 . According to Theorem 4, the proof of 
converse is established. 

Corollary 2: If the input and outputs of a state-dependent 
3-receiver broadcast channel form a Markov chain as Y\ — > 
(X, S)^Y 2 ^ Z, i.e., Y 2 and Z are degraded versions of Yi. 
The private key capacity region reduces to: 

Ri=I(X,S;Y 1 \Y 2 ) , i? 2 =0 (28) 

Proof: The proof is similar to Corollary 1. 

Corollary 3: If the input and outputs of a state-dependent 
3-receiver broadcast channel form a Markov chain as Y 2 — > 
(X, S) -> Z -> Yi, i.e., Yi and Z are degraded versions of 
Y 2 . The private key capacity region reduces to: 

#1=0 , R 2 = I(X,S:Y 2 \Z) (29) 

Proof: The proof is similar to Corollary 1. 

Corollary 4: If the input and outputs of a state-dependent 
3-receiver broadcast channel form a Markov chain as Y 2 — > 
(X, S) -> Yi -> Z, i.e., Yi and Z are degraded versions of 
Y 2 . The private key capacity region reduces to: 

R 1= , R 2 =I(X,S;Y 2 \Y 1 ) (30) 

Proof: The proof is similar to Corollary 1. 

IV. Proofs 

In this section, we present the proofs of the main results. 
This section contains two parts. In the first part, the proofs 
of the inner and outer bounds on the secret key capacity 
region for the model without public discussion are given. In 
the achievability, the hybrid joint source channel coding and 
the random binning are used. In the second part, the proofs of 
the model with public discussion are illustrated. The double 
random binning is utilized to achieve the inner bound. The 
proofs of the outer bounds are similar to [3] for both cases. 

A. Proof of Theorem 1 

Fix conditional probability density function 

P[/ ,(7l^2|s( u 0,Ul,M2|s)- 

Codebook Generation: Generate 2 nRa sequences Uq(i71 Uo ) 
m UQ e [1 : 2 nRa ), each according to JJLi Pu ( u oi)- Then, 
randomly and independently partition them into 2 nRo bins. 
For each m Uo , we generate 2 nRl sequences C/"(m Ul ), m Ul G 
[1 : 2 nRl ) each according to II"=i2 > t/i|t/o( ti i*l u 0i)> and parti- 
tion them into 2 nRl bins. Similarly, for each m Uo , we generate 
2 nR2 sequences U 2 (m U2 ), m U2 e [1 : 2 nR ' 2 ) each according 
to n™=iP(72|^o( u 2i|uoi)- At the end, randomly partition the 
sequences U 2 into 2 nR2 bins. Codebook C u% contains 2 nR% 
sequences {7™ for i = 0, 1, 2. 

Encoding: For each sequence s", the encoder chooses a 
triple (m Uo ,m Ul ,m U2 ) such that 

(*" , uZ (m U0 ) , ul (m Ul ) , u n 2 (m U2 ) ) e T £ (n) {S,U ,U U U 2 ). 



Then, the transmitter sends Xi — x i (s i ,u 0i ,ui i ,u 2i ) for 
i e [1 : n] over the 3-receiver broadcast channel. By the cov- 
ering lemma [12], this can be done with an arbitrarily small 
probability of error if: 

R >I{U ;S) 
Ri >I(Ui;S\U ) 

R2>I(U 2 ;S\U ) (31) 

Decoding: After receiving y™, the first legitimate receiver 
finds a sequence pair (uq (rh Uo ), tt"(m Ul )), such that 

K(m U0 ),<(m Ul ),yn e T^ n) {U Q ,Ux,Y{). 

Similarly, upon observing y 2 tne second legitimate receiver 
finds a sequence pair (uq (m Uo ), u 2 (rh U2 )), such that 

K (m« ) . «2 (m„ 2 ) , y 2 " ) € T} n) (U , (7 2 , Y 2 ) . 

By the packing lemma [12], the probability of error tends to 
zero asn^oo if: 

£ <mm{/(Uo;n),/(*7o;*2)} 
Ri < HUuY^Uo) 

R2 < I(U 2 ;Y 2 \U ). (32) 

Secret Key Generation: After decoding, the transmitter and 
the legitimate receivers agree on the bin index of u„ to be the 
public key k . The transmitter and the first legitimate receiver 
agree on the bin index of u\ as the private key, likewise, the 
second legitimate receiver agrees on the bin index of u 2 as 
the private-key k 2 with the transmitter. 

Analysis of Secrecy: In order to check the security condition 
on the common key rate averaged over the random codebook 
assignments C u ° we have: 

I{K - Z n \C Uo ) = H(K \C Uo ) - H(K \Z n ,C Uo ) 
= H(K \C Ua ) - H{K , Uo I Z n , C u ° ) + H(U£ \ K , Z n , C u ° ) 
= H{K \C Ua ) - H(Uo\Z n ,C U ") - H(K \Uo,Z n ,C Uo ) 
+ H(Uo\K ,Z n ,C Uo ) = H{K \C Ua )-H(Uo\Z n ,C U ") 

+ H(Uo\K , Z n ,C Uo ) < nRo - H(U£\Z n ,C u °) 

+ H(Uo\K , Z n ,C u °) < nR - nRo + nI(U ; Z) + nRo - nRo 

— nI(Uo; Z) + ne = ne 

as K is the bin index of U$, the equality H(K \Uft, Z n , 
C u °) = holds which deduces (a), (b) can be deduced from 
inequalities H(U$\Z n ,C Uo ) < nR - nI(U ;Z) + ne and 
H(U£\K ,Z n ,C Ua ) < nR -nR -nI(U ;Z)+ne if R < 
mm{I(U ;Y 1 ),I(U ;Y 2 )}-I(U ;Z)+e, the proof is similar 
to [Lemma 22.3, 12]. 

Also, to check the secrecy conditions for the private key 
rate i?i averaged on the random codebook assignments C Ul , 
we have: 

I(K i; Ko,K 2 ,Y 2 n \C Ul ) < I(KuUS,U2,Y2\C Ul ) 
= tf(i^|C r/l ) - HiK^U^U^Y^lC" 1 ) 
= H(Ki\C Ul ) — H(K U U?\UZ, US, Y 2 n ,C Ul ) 
+ H(U?\K 1 ,UZ,U?,Y 2 n ,C Ul ) 



= H(K!\C Ul ) - H(U?\U£,U2,Y 2 n ,C Ul ) 

— H(Ki\ US , U? , U^ ,Y 2 n ,C Ul ) + H(Ur\K 1 , US , US , Y 2 n , C Ul ) 

( =' HiK^) -H(U?\UZ,U?,Y 2 n ,C Ul ) 

(6) 

+ H(U? I Ki , US , U^ , Y 2 n , C Ul ) < nR 1 - nR x + nI(U 1 ;U 2 ,Y 2 \U ) 
+ nRi — nRi — nI(Ui; U 2 , Y 2 \Uo) + ne = ne 

as K x is the bin index of U?, the equality H(K X \US, Uf , 
U?,Y?,C Ul ) = holds which deduces (a), (b) can be 
deduced from inequalities H(U?\U$, U 7 2 \ Y 2 n , C Ul ) < nR x - 
nI(U i; Y 2 ,U 2 \Uo) +ne and H(U? \K U U$, U?, Y?,C U >) < 
nRi -nRi - uIOJ^Y^U^Uq) + ne if i?j < J(£/ i; Y 1 \U ) 

— I(Ui;Y 2 ,U 2 \Uo)+ne, the proof is similar to [Lemma 22.3, 
12]. And, 

I(K i; Z n \C Ul ) < I(K 1 ;US,Z n \C Ul ) 
= HiK^C 01 ) - H{K!\US ,Z n ,C Ul ) = H(Ki\C Ul ) 

- H(K 1 ,U?\U a ,Z n ,C Ul ) + H(U?\K!,U?,Z n ,C Ul ) 

= HiK^C 111 ) -H{U?\U£,Z n ,C Ul ) - H(K x \Uo,US,Z n ,C Ur ) 
+ H(Ui\K 1 ,Uo,Z n ,C Ul ) = H(K!\C Ul ) - H{U"\Uo, Z n ,C Ul ) 

(6) 

+ H(U?\K U US ,Z n ,C Ul ) < nR 1 -nR 1 +nI(U 1 ;Z\U ) + nR 1 

- nRi_ - nI(Ui;Z\U ) + ne = ne 

as K x is the bin index of U?, the equality HiK^Ug, U? , Z n , 
C Ul ) — holds which deduces (a), (b) can be deduced from 
inequalities H(U[ l \U£ , Z n ,C Ul ) < nR^ - nI{U x ; Z\U ) +ne 
and^^(C/^ ^ | J ft:l,C/ ,l ,Z",C ,7l ) < nR 1 -nR 1 -nI(U 1 ;Z\U ) + 
ne if Rx < J(?7i;Fi|Uo) - /(t/i; Z|t7 ) + ne, the proof is 
similar to [Lemma 22.3, 12]. Finally, we have: 

R 1 < mm{I(U i; Y^Uo) - I(U i; Y 2 , U 2 \U ), 
liU^Y^-HU^ZlUo)}. 

Similarly, we can check the security conditions for K 2 . 

B. Proof of Theorem 2 

In our described model, each legitimate receiver should be 
able to estimate common key fc correctly and according to the 
Fano's inequality ±H{Ko\Y?) < e and \H(K \Y?) < e. and 
also, the security condition ^I(Kq; Z n ) < e must be satisfied: 
We find an outer bound on R . (outer bounds on i?i and R 2 
can be obtained similarly) 

nR = H(K ) = I(K ; Y") + H{K \Y?) 

< I(K ; YD + ne< I(K ; Y? , Z n ) + ne 

= I(K ; Z n ) + I(K ; Y?\Z n ) + ne < I(K Q ; Yr\Z n ) + 2ne 

< I(K , K u K 2 , X n , S n ;Y?\Z n ) + 2ne = I(X n , S n ;Y?\Z n ) 
+ I(K , K u K 2 - Yf\Z n ,X n , S n ) + 2ne 

< I(X n ,S n ;Yr\Z n ) + 3ne 

<J2l{X i ,S i ;Y li \Z i ) + 3ne < I(X Q , S Q ;Y 1Q \Z Q ,Q) + 3ne 

i=l 

= I(X Q ,S Q ;Y 1Q \Z Q ) + 3ne 

where (a) follows from the Fano's inequality, (b) comes 
from the security condition, (c) can be deduced from the 



Markov chain (K ,K 1 ,K 2 ) -> {S n ,X n ) -> (Y{ l ,Y 2 n ,Z n ) 
and (d) can be obtained by defining Q as a uniform ran- 
dom variable over [1 : n]. Also in a similar way, we have 
R < I(X, S; Y 2 \Z). Finally, we have 

Ro Kmmil&SiY^I&SMlZ)}. 

C. Proof of Theorem 3 

Our achievability proof is closely related to the achievability 
proof in [9]. In addition, the double random binning is used 
to satisfy secrecy constrains. The achievability proof is as 
follows: 

Codebook Generation: We consider the set of all typical 
sequences y™ and y 2 . The number of the typical sequences 
y{ 1 and y% are 2 n ^ H ^ +t ^ and 2 n( - H( - Y2 '> +e2 \ respectively, 
where ei,e 2 > can be chosen arbitrarily small. We utilized 
the double random binning. Therefore, we have: 

yjiijjjjj) for j = 1,2 

ij e [1 : 2 nH(Y ^), %'. G [1 : 2 nR 'i), i'j e [1 : 2 nR " ) 

Encoding: With the channel state sequence s n observed, the 
transmitter randomly and independently generates a codeword 
x n according to the conditional distribution ]J™ =1 px\s(xi\si), 
and transmits Xi for i £ [1 : n] over the 3-receiver broadcast 
channel with the channel probability distribution Vy x ,y 2 .z\x,s- 

Use of The Public Channel: On the basis of channel output 
sequence y™ the first legitimate receiver finds the bin index 
of y" according to the codebook and sends the bin index of 
y™ via the public channel. Similarly, the second legitimate 
receiver finds the bin index of y 2 and transmits the bin index 
of y 2 over the public channel. 

Secret Key Generation: The transmitter upon receiving the 
bin indices of y™ and y 2 from the public channel and by the 
knowledge of x n and s n can recover y™ and y 2 . Then both 
transmitter and the first legitimate receiver agree on the sub-bin 
index of y" as the private key. Similarly, the second legitimate 
receiver and the transmitter agree on the sub-bin index of y 2 
as their private key. 

Analysis of The Probability of Error: From the Slepian and 
Wolf coding, the transmitter finds y™ and y 2 after receiving the 
bin indices of y" and y 2 from the public channel, respectively. 
By the packing lemma, the probability of error tends to zero 
as n — > oo if: 

ff(Yi)-i2i <I{X,S;Y X ) 
H(Y 2 )-R' 2 <I(X,S;Y 2 ) (33) 

Analysis of Secrecy: In order to check the security condi- 
tions, we have: 

I(Kv, K a ,Y?, fa, *h) = H(K 1 )- H^K^Y? ,fa, fa) 
= H(Ki) — H(Ki,Y{ l \K2, Y 2 n , fa, fa) 
+ H{Y?\K l ,K 2 ,Y 2 n ,fa,fa) 

( =' H(K!) - H(Y?\K 2 , Y 2 n fa, ih) + H{Y?\K u K 2 ,Y 2 n , fa, fa) 



< nR" - nH{Y\) + nR[ + nI(Yv,Y 2 ) + nH(Y l ) 
— nR[ — nR" — nI(Yi; Y 2 ) = ne 

as K\ is the sub-bin index of Y", the equality H(Ki\K 2 , Y™ , 
Y 2 n , ip\,ip 2 ) = holds which deduces (a), (b) can be deduced 
from inequalities H{Y^ l \K 2 ,Y 2 n fa,^ 2 ) < nH{Y 1 ) - nR[ - 
nI{Yx ; Y 2 ) + ne and H(Y? \ K x , K 2 , Y 2 n , fa , ^ 2 ) < nH(Y 1 ) - 
nR' l -nR'{-nI{Y l -Y 2 )+neifR l < I(X, S;Y 1 )-I(Y 1 ;Y 2 ) + 
ne, the proof is similar to [lemma 22.3, 12] .Also in a similar 
way, we have Ri < I(X, S; Yi) - I(Yi; Z). Finally, we have: 

R 1 < min{I(X, S; H) - /(F i; Y 2 ), I(X, S: Y,) - I(Y i; Z)}. 

Similarly, we can check the security conditions for K 2 . 

V. Conclusions 

The problem of secret key agreement over state-dependent 
3-receiver broadcast channels is investigated. We study two 
cases for this problem. In the first case, the transmitter intends 
to share a common key with both legitimate receivers while 
keeping it concealed from the eavesdropper. The transmitter 
wishes to share a private key with each of the legitimate 
receivers. For this case, we have obtained inner and outer 
bounds to the secret keys capacity. In the second case, each of 
the legitimate receivers wants to share a private key with the 
transmitter using a 3-receiver broadcast channel and a back- 
ward public channel. For this case, the private key capacity 
region are derived for some special cases. 
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